# SyteLine Security and User Access Audit Checklist > Source: https://netray.co/tools/syteline-security-and-user-access-audit-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A checklist for reviewing SyteLine users, authorizations, service accounts and integrations before an audit or after a staffing change. ## Category compliance-legal ## Erp Infor SyteLine ## Audience - SyteLine admin - Internal auditor - IT security ## Tool **Kind:** checklist **Groups:** #### Users and accounts **Items:** **Text:** Every active user maps to a current employee or named contractor **Critical:** true **Text:** Leavers are disabled in SyteLine and in the directory **Critical:** true **Text:** Shared and generic accounts are listed, justified or removed **Critical:** true Inactive accounts over 90 days are reviewed **Text:** Default and vendor-supplied accounts have changed credentials **Critical:** true New user requests have a recorded approval #### Roles and authorizations **Items:** Authorization groups are documented with an owner for each **Text:** Administrator rights are limited to named people **Critical:** true **Text:** Users with form access to setup and parameters are reviewed **Critical:** true Access to costing, price and margin data matches job roles **Text:** Access to bank, payment and vendor master changes is restricted **Critical:** true Permissions are reviewed each time a person changes role #### Segregation of duties **Items:** **Text:** No one both creates vendors and approves payments **Critical:** true **Text:** No one both creates purchase orders and receives goods **Critical:** true Inventory adjusters are separate from stock custodians where practical **Text:** Journal entry creators differ from approvers **Critical:** true Price and discount changes need review by a second person Compensating controls are written down where separation is not possible #### Service accounts and integrations **Items:** **Text:** Each integration uses its own account, not a person's **Critical:** true **Text:** Service accounts have only the IDO and form access they need **Critical:** true Passwords or tokens are stored in a secrets store, not in scripts **Text:** Direct database logins are limited and reviewed **Critical:** true Integration owners are named and contactable Interface logs are retained and checked for failures #### Monitoring and evidence **Items:** Audit trail or change logging is enabled for sensitive data Failed logins and lockouts are reviewed **Text:** Access reviews are done on a regular schedule with sign-off **Critical:** true Evidence from the review is stored for auditors Remediation items have owners and due dates **Scoring Note:** Any unchecked critical item is a finding to log with an owner and date. The checklist is a review aid, not a replacement for your auditor's procedures or your internal policy. ## Content **Intro:** Access in an ERP tends to grow and rarely shrinks. This checklist guides a review of SyteLine users, authorization groups, segregation of duties and service accounts, so that a finding is caught in your own review and not in an external audit. **Sections:** #### How to use the checklist **Body:** Run the review with the SyteLine admin, a representative from finance and the process owners, working from a current export of users and their authorizations. Tick each item as verified, note exceptions, and assign owners. Repeat at least once a year and after reorganizations. Export the completed list as evidence for auditors and keep the user export alongside it. **Bullets:** - Start from a fresh export, not memory - Review by role, not by individual alone - Record decisions, not just results #### Segregation of duties in practice **Body:** Small teams often cannot fully separate duties. In that case, document the conflict and the compensating control, such as a manager review of a daily exception report. What auditors dislike is not an imperfect separation, but an undocumented one. Focus first on high-risk pairs: vendor setup with payments, purchasing with receiving, and journal entry with approval. #### Service accounts and integrations **Body:** Integrations are often the weakest part of access control. A shared account with administrator rights used by a script written years ago is common. Replace it with a dedicated account limited to the IDOs and forms it needs, rotate credentials, and store them properly. Review who owns each interface so that someone answers when it fails or changes. **Cta:** Netray can help build a read-only access report from your SyteLine user and authorization data that highlights conflicts for your reviewers to assess. **Faq:** #### How often should we review SyteLine user access? **Answer:** At least annually, and after any reorganization, system change or audit finding. Many companies run a quarterly review of privileged accounts and a yearly review of all users, matching their audit cycle. #### What is the biggest access risk in an ERP like SyteLine? **Answer:** Excess privilege that accumulates when people change roles, plus shared and service accounts with broad rights. Both are easy to overlook because nothing breaks until someone looks. #### Do we need to do this for SOX compliance? **Answer:** If SyteLine supports financial reporting at a regulated company, access reviews are a standard control. Your auditor defines the exact evidence needed, so align the checklist with their requirements. #### How do I get a list of users and their permissions? **Answer:** Use the user and authorization forms or the relevant IDOs to export the data, or ask your administrator for a report. Compare it with HR's current employee list to find leavers and mismatches. ## Search terms syteline security audit, syteline user access review, syteline segregation of duties, syteline permissions, syteline authorization groups, erp user access audit checklist, syteline service account, syteline sox controls --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json